Creating an Internal Connection using DNS, WireGuard, and Traefik with Docker
In this article, we will explore how to create an internal connection using DNS, WireGuard, and Traefik with Docker. We will cover the key concepts and provide detailed context on the topic. The article will be at least 800 words long and will include subtitles, paragraphs, and code blocks as needed.
Introduction
In today's world, Docker has become an essential tool for developers and system administrators. Docker allows you to package your application and its dependencies into a single container that can be run on any system that supports Docker. This makes it easy to deploy your application to different environments, such as development, testing, and production.
In this article, we will focus on creating an internal connection using DNS, WireGuard, and Traefik with Docker. We will assume that you have three Docker containers running on a VPS with Ubuntu 24.04 LTS: wg-easy (WireGuard VPN), traefik (v3), and whoami (traefik). We will also assume that traefik is already set up and configured correctly, and that whoami can be reached using traefik.
Setting up DNS
The first step in creating an internal connection is to set up DNS. DNS is a system that translates domain names into IP addresses. In this case, we will be using DNS to translate the domain name of our VPS into the IP address of our WireGuard VPN container.
To set up DNS, we will need to edit the /etc/hosts file on our VPS. The /etc/hosts file is a simple text file that maps domain names to IP addresses. We will add an entry to the /etc/hosts file that maps the domain name of our VPS to the IP address of our WireGuard VPN container.
sudo nano /etc/hosts
# Add the following line to the file
10.0.0.1 wireguard.example.com wireguard
In the above example, we are mapping the domain name wireguard.example.com to the IP address 10.0.0.1, which is the IP address of our WireGuard VPN container. We are also adding an alias for the domain name wireguard, which we will use later.
Setting up WireGuard
The next step is to set up WireGuard. WireGuard is a simple, fast, and secure VPN that can be used to create an internal network between different containers.
To set up WireGuard, we will need to create a new WireGuard interface on our VPS. We will use the wg-easy tool to create the interface. The wg-easy tool is a simple script that generates a WireGuard configuration file for us.
wg-easy genkey | sudo tee /etc/wireguard/privatekey | wg-easy genconf wg0
# Add the following lines to the generated configuration file
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [generated private key]
[Peer]
PublicKey = [generated public key]
Endpoint = whoami:51820
AllowedIPs = 10.0.0.2/32
In the above example, we are generating a new private key for our WireGuard interface and using the wg-easy tool to generate a WireGuard configuration file. We are setting the address of our WireGuard interface to 10.0.0.1/24, which is the same address that we used in our DNS configuration. We are also setting the listen port to 51820 and adding a peer to our configuration.
The peer configuration specifies the public key of our whoami container, the endpoint of our whoami container (whoami:51820), and the allowed IPs for our whoami container (10.0.0.2/32). This means that our WireGuard interface will route traffic to our whoami container using the specified endpoint and IP address.
Setting up Traefik
The final step is to set up Traefik. Traefik is a reverse proxy that can be used to route traffic to different containers. In this case, we will be using Traefik to route traffic to our whoami container.
To set up Traefik, we will need to create a new Docker network and add our Traefik and whoami containers to the network. We will also need to configure Traefik to route traffic to our whoami container.
docker network create traefik
docker run -d --name whoami --network traefik -p 80:80 whoami
docker run -d --name traefik \
--network traefik \
-p 8080:8080 \
-v $PWD/traefik.toml:/etc/traefik/traefik.toml \
-v /var/run/docker.sock:/var/run/docker.sock \
traefik:v3
In the above example, we are creating a new Docker network called traefik and adding our Traefik and whoami containers to the network. We are also exposing port 80 on our whoami container and port 8080 on our Traefik container. We are also mounting a configuration file for Traefik and the Docker socket to allow Traefik to monitor the Docker daemon.
The Traefik configuration file specifies how Traefik should route traffic to our whoami container. Here is an example configuration file:
logLevel = "ERROR"
[entryPoints]
[entryPoints.web]
address = ":80"
[api]
dashboard = true
[providers.docker]
endpoint = "unix:///var/run/docker.sock"
network = "traefik"
In this configuration file, we are setting the log level to ERROR, exposing port 80 for HTTP traffic, and enabling the Traefik dashboard. We are also specifying that Traefik should use the Docker provider and monitor the traefik network for changes.
In this article, we have explored how to create an internal connection using DNS, WireGuard, and Traefik with Docker. We have covered the key concepts and provided detailed context on the topic. We have also provided code examples and configuration files to help you get started.
References
- WireGuard: https://www.wireguard.com/
- Traefik: https://traefik.io/
- Docker: https://www.docker.com/